nbd: CVE-2015-0847: unsafe signal handling

Related Vulnerabilities: CVE-2015-0847   CVE-2013-7441  

Debian Bug report logs - #784657
nbd: CVE-2015-0847: unsafe signal handling

version graph

Package: src:nbd; Maintainer for src:nbd is Wouter Verhelst <wouter@debian.org>;

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Thu, 7 May 2015 14:27:02 UTC

Severity: important

Tags: patch, security, upstream

Found in versions nbd/1:3.2-4~deb7u4~bpo60+1, nbd/1:2.9.16-8+squeeze1, nbd/1:3.2-4~deb7u4, nbd/1:3.8-4

Fixed in versions nbd/1:3.10-1, nbd/1:2.9.16-8+squeeze2, nbd/1:3.8-4+deb8u1, nbd/1:3.2-4~deb7u5

Done: Wouter Verhelst <wouter@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Wouter Verhelst <wouter@debian.org>:
Bug#784657; Package src:nbd. (Thu, 07 May 2015 14:27:06 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Wouter Verhelst <wouter@debian.org>. (Thu, 07 May 2015 14:27:06 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: nbd: CVE-2015-0847: unsafe signal handling
Date: Thu, 07 May 2015 16:23:49 +0200
Source: nbd
Version: 1:3.8-4
Severity: important
Tags: security upstream patch

Hi,

the following vulnerability was published for nbd.

CVE-2015-0847[0]:
unsafe signal handling

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-0847
[1] http://sourceforge.net/p/nbd/mailman/message/34091218/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore



Information forwarded to debian-bugs-dist@lists.debian.org, Wouter Verhelst <wouter@debian.org>:
Bug#784657; Package src:nbd. (Wed, 13 May 2015 12:54:17 GMT) (full text, mbox, link).


Acknowledgement sent to Raphael Hertzog <hertzog@debian.org>:
Extra info received and forwarded to list. Copy sent to Wouter Verhelst <wouter@debian.org>. (Wed, 13 May 2015 12:54:17 GMT) (full text, mbox, link).


Message #10 received at 784657@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>
To: Wouter Verhelst <wouter@debian.org>
Cc: debian-lts@lists.debian.org, 784657@bugs.debian.org
Subject: squeeze update of nbd?
Date: Wed, 13 May 2015 14:50:49 +0200
Hello Wouter,

the Debian LTS team would like to fix the security issues which are
currently open in the Squeeze version of nbd:
https://security-tracker.debian.org/tracker/CVE-2015-0847

Would you like to take care of this yourself? We are still understaffed so
any help is always highly appreciated.

If yes, please follow the workflow we have defined here:
http://wiki.debian.org/LTS/Development

If that workflow is a burden to you, feel free to just prepare an
updated source package and send it to debian-lts@lists.debian.org
(via a debdiff, or with an URL pointing to the the source package,
or even with a pointer to your packaging repository), and the members
of the LTS team will take care of the rest. Indicate clearly whether you
have tested the updated package or not.

If you don't want to take care of this update, it's not a problem, we
will do our best with your package. Just let us know whether you would
like to review and/or test the updated package before it gets released.

Thank you very much.

Raphaël Hertzog,
  on behalf of the Debian LTS team.

PS: A member of the LTS team might start working on this update at
any point in time. You can verify whether someone is registered
on this update in this file:
https://anonscm.debian.org/viewvc/secure-testing/data/dla-needed.txt?view=markup
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/



Information forwarded to debian-bugs-dist@lists.debian.org, Wouter Verhelst <wouter@debian.org>:
Bug#784657; Package src:nbd. (Wed, 13 May 2015 22:45:09 GMT) (full text, mbox, link).


Acknowledgement sent to Wouter Verhelst <w@uter.be>:
Extra info received and forwarded to list. Copy sent to Wouter Verhelst <wouter@debian.org>. (Wed, 13 May 2015 22:45:09 GMT) (full text, mbox, link).


Message #15 received at 784657@bugs.debian.org (full text, mbox, reply):

From: Wouter Verhelst <w@uter.be>
To: Raphael Hertzog <hertzog@debian.org>, debian-lts@lists.debian.org, 784657@bugs.debian.org
Subject: Re: squeeze update of nbd?
Date: Thu, 14 May 2015 00:42:30 +0200
On Wed, May 13, 2015 at 02:50:49PM +0200, Raphael Hertzog wrote:
> Hello Wouter,
> 
> the Debian LTS team would like to fix the security issues which are
> currently open in the Squeeze version of nbd:
> https://security-tracker.debian.org/tracker/CVE-2015-0847
> 
> Would you like to take care of this yourself? We are still understaffed so
> any help is always highly appreciated.

I was planning to, yes. Time has been an issue, but this weekend is a
long weekend (thursday is a public holiday, friday most companies are
closed).

> If yes, please follow the workflow we have defined here:
> http://wiki.debian.org/LTS/Development

Will do.

Regards,

-- 
It is easy to love a country that is famous for chocolate and beer

  -- Barack Obama, speaking in Brussels, Belgium, 2014-03-26



Reply sent to Wouter Verhelst <wouter@debian.org>:
You have taken responsibility. (Sun, 17 May 2015 09:39:14 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Sun, 17 May 2015 09:39:14 GMT) (full text, mbox, link).


Message #20 received at 784657-close@bugs.debian.org (full text, mbox, reply):

From: Wouter Verhelst <wouter@debian.org>
To: 784657-close@bugs.debian.org
Subject: Bug#784657: fixed in nbd 1:2.9.16-8+squeeze2
Date: Sun, 17 May 2015 09:37:11 +0000
Source: nbd
Source-Version: 1:2.9.16-8+squeeze2

We believe that the bug you reported is fixed in the latest version of
nbd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 784657@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Wouter Verhelst <wouter@debian.org> (supplier of updated nbd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 15 May 2015 18:52:57 +0200
Source: nbd
Binary: nbd-server nbd-client nbd-client-udeb
Architecture: source amd64
Version: 1:2.9.16-8+squeeze2
Distribution: squeeze-lts
Urgency: medium
Maintainer: Wouter Verhelst <wouter@debian.org>
Changed-By: Wouter Verhelst <wouter@debian.org>
Description: 
 nbd-client - Network Block Device protocol - client
 nbd-client-udeb - Network Block Device protocol - client for Debian Installer (udeb)
 nbd-server - Network Block Device protocol - server
Closes: 784657
Changes: 
 nbd (1:2.9.16-8+squeeze2) squeeze-lts; urgency=medium
 .
   * Backport (relevant parts of) fix for CVE-2015-0847. Closes: #784657.
Checksums-Sha1: 
 9a7b19ccd9834889586834ea414017cb75b8a0d7 1793 nbd_2.9.16-8+squeeze2.dsc
 faa627b0195723215639392e59f37f4e28921af9 192525 nbd_2.9.16-8+squeeze2.diff.gz
 32e29675ac8cb50f7f289194671595d1438c23fd 60824 nbd-server_2.9.16-8+squeeze2_amd64.deb
 7a5dc84c7e2d4260f17a864f27b36c27b1b2d72e 51666 nbd-client_2.9.16-8+squeeze2_amd64.deb
 6730e4b684915921e94ae74c585b24823b39d76a 6958 nbd-client-udeb_2.9.16-8+squeeze2_amd64.udeb
Checksums-Sha256: 
 5e56d84a61945f56836ad4925c5297561565bdd934ab7e9ed937ec6507506a28 1793 nbd_2.9.16-8+squeeze2.dsc
 1f55e82943bb28e71d52aeb288125706e56a2434f9a736f186249b354986d208 192525 nbd_2.9.16-8+squeeze2.diff.gz
 bc4ccb117be776eb94448ce21334d10c6de007b86e2496d9bf250b80d2b62fb8 60824 nbd-server_2.9.16-8+squeeze2_amd64.deb
 8378bde21faa85b3f87a22384ab6cd44966c1fa12f31f6a4f9fed94e1d1ba0cf 51666 nbd-client_2.9.16-8+squeeze2_amd64.deb
 0fbfb6f9268357854775ad9ce6307dba1cfb4a65f3e8d7adec1d7fa0dc66abca 6958 nbd-client-udeb_2.9.16-8+squeeze2_amd64.udeb
Files: 
 cbc1d8aa26dd5080bc997573e9c5160a 1793 admin optional nbd_2.9.16-8+squeeze2.dsc
 02279dcffe12a2517b33dcacd47d9c03 192525 admin optional nbd_2.9.16-8+squeeze2.diff.gz
 6b1ea181e6bfb7147b3e1d39b72121d5 60824 admin optional nbd-server_2.9.16-8+squeeze2_amd64.deb
 37cc21377f7ec2b418ad1880c84c0ac2 51666 admin optional nbd-client_2.9.16-8+squeeze2_amd64.deb
 56526da5c22a5260059063e1de88871f 6958 debian-installer optional nbd-client-udeb_2.9.16-8+squeeze2_amd64.udeb
Package-Type: udeb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVWFrxAAoJEMKUD5Ub3wqd+N8P/AgFx3f6jqT2dII5TPRLlX2A
I9Kf2oLwOAb264xXThqmbxGe7qz/d5Sqzd52x5Q4frwE/L+tpXZMcqlTVf7C+B5i
3Aaj3dRwTancBX2R6BA5AeU6kred9fAVJJ+LbYHdapvgdDszXlCnV2oU5s5UNi1I
uOezLZNcUKZwQFiVhI/bKcgU+K1gaJDzAvv20bnC5iktwiDZj4XUIsr3pTDsXJhp
GtFCUPk7vCXeJtt1HOH4bpGupeXqqGpWG4l7yo4TgvHKcq846K8jBuxQJkq0FUNk
UjZWymxErET8VpKnDtILRAVvxanqGlgT9iz5HWv2hRIYvj9stiDYvk4BTvFpLQ6t
F33j442fi/yPF4DFcZDNWwoBdlaiiJbDAcY5yJCjtCCVgMM8/bVvw993XEK3cP1L
74VCGbaUkVcyb6sn66jERju+l1xFEgnD+sNUMyNg2Av2ppHuZ94ldhTdumHAUHsg
Zj83MSl625eQz0zU+X2tqoSUhZnfSpKDO//EYHjO/FuVDoitp3lIeiGp6R5ih4MJ
EUCuG65B3Dv8u6tKlwHTJq29FkYy4xPWcc/oXQbueqieQQG8pPUBl3Ipt1qNsXjk
Sg+M3H7DhgLEkojuK+kYVblQfZruBWRJW9Y8ZhTmxq/0uNnnGJGZZMWEVHuWhOs1
soZBISgOkxJZ85S9JSRg
=Z8Ke
-----END PGP SIGNATURE-----




Reply sent to Wouter Verhelst <wouter@debian.org>:
You have taken responsibility. (Sun, 17 May 2015 11:06:16 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Sun, 17 May 2015 11:06:16 GMT) (full text, mbox, link).


Message #25 received at 784657-close@bugs.debian.org (full text, mbox, reply):

From: Wouter Verhelst <wouter@debian.org>
To: 784657-close@bugs.debian.org
Subject: Bug#784657: fixed in nbd 1:3.10-1
Date: Sun, 17 May 2015 11:04:26 +0000
Source: nbd
Source-Version: 1:3.10-1

We believe that the bug you reported is fixed in the latest version of
nbd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 784657@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Wouter Verhelst <wouter@debian.org> (supplier of updated nbd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 17 May 2015 10:49:32 +0200
Source: nbd
Binary: nbd-server nbd-client nbd-client-udeb
Architecture: source amd64
Version: 1:3.10-1
Distribution: unstable
Urgency: medium
Maintainer: Wouter Verhelst <wouter@debian.org>
Changed-By: Wouter Verhelst <wouter@debian.org>
Description:
 nbd-client - Network Block Device protocol - client
 nbd-client-udeb - Network Block Device protocol - client for Debian Installer (udeb)
 nbd-server - Network Block Device protocol - server
Closes: 470963 784657
Changes:
 nbd (1:3.10-1) unstable; urgency=medium
 .
   * New upstream release.
     - Includes new "cowdir" option; Closes: #470963.
   * Cherry-pick patch for CVE-2015-0847 from git HEAD; Closes: #784657.
Checksums-Sha1:
 ad3b4d4498de4a89557ad8939cb085e2af934e5f 1920 nbd_3.10-1.dsc
 c16f83fc5d83fb27d6c971ecf37b501c61c8dd02 950744 nbd_3.10.orig.tar.gz
 b20ab8683b807e48f0a15bb5af4ee84a127260d5 100991 nbd_3.10-1.diff.gz
 4e165a4d09fc565a0bbff51e0a83db55c0042e5f 82612 nbd-server_3.10-1_amd64.deb
 a1d934f0bd3555fb3c961041f9978ef274480ef2 68696 nbd-client_3.10-1_amd64.deb
 af3e7f5d9f8528a6bea7a0dabd293fa168cd422b 8608 nbd-client-udeb_3.10-1_amd64.udeb
Checksums-Sha256:
 cca4e1724e7a8eca086a6d06712f382b349a6dfdc2735358759d5a640c7e813c 1920 nbd_3.10-1.dsc
 11e302fcef000de7caaf4367073697edadb1c655796d8b393d17a5570e8dbccf 950744 nbd_3.10.orig.tar.gz
 3669dcffbce1e1a5a71b6337c287c271874e4cb831071239b7ad80442af0d870 100991 nbd_3.10-1.diff.gz
 3ceec6a091bae1f15afa08d953f18b8d60840e73719741bcdafc0c38f614167b 82612 nbd-server_3.10-1_amd64.deb
 d7a4d82727629368f82734df137313da79af03c9e61626fa4b33297fd440e638 68696 nbd-client_3.10-1_amd64.deb
 40f49b05366b2d3c9097d01e2f10289983e635ab2f2c1b5a6ae3bdad63ed06fc 8608 nbd-client-udeb_3.10-1_amd64.udeb
Files:
 949493e1be53e9832b562fdd646d9e00 1920 admin optional nbd_3.10-1.dsc
 1b34f2f0e5a7a6f71ad27739dbddf9a1 950744 admin optional nbd_3.10.orig.tar.gz
 13afeff98aea412ec86123589bc6eda3 100991 admin optional nbd_3.10-1.diff.gz
 a6fd02e6ef4e1f4356b0fa0ae4f99c4c 82612 admin optional nbd-server_3.10-1_amd64.deb
 38fdc7c6215ec62cd0dd8c60499d0afd 68696 admin optional nbd-client_3.10-1_amd64.deb
 eb5ede486174f4a797e505947fa95ac2 8608 debian-installer optional nbd-client-udeb_3.10-1_amd64.udeb
Package-Type: udeb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVWHLqAAoJEMKUD5Ub3wqdhzsP+wc+OAgdTDMNMp7+9+XYKEs9
JJJxlgRQt91hre44p0N5LZ+XK237d+dEQNv/SvtR62L7tr7Forw3W5alGJfvJLaf
+FqL8IAZJlkM4RD53NyK9nvZUlEnrreBxnmPkEDPmjPuW3eThxxApLMddHXQ0q2r
F/+JLi1k+T7BcDfhfaTdNSCRgA42tjWG/Jj6AWCSPU8xP/WC/+0ZAk4F7afuJR0v
aLGW0bzIQoNYQ8To7vNFnG32kZ8SF+4Sxmix+V8x1hS8z155hRI8nRYuEBC2XK18
zoCDOBgp1cBTdUZIcbv+qioKhfhLhbBsy637YGirMJknDTl1FpF71MDH9I/Chfeo
oc9J3eCy0i7nC6GMqorPfHXuJt6ODLVLqbDCVmlYpv5vRuZM362Q6tb1Ize1lTrg
TaQBD1Rr8gru/jeRiZoA/Ehjvfbd9f8tAgZ8kzomheRAgxtg9EzcCRMX2/014r5j
CKWFjmr1DMklSC9ebaqiUcEYUCa9ySewEylcUDmau1TAorgmMrbsaxJF7XIaYCfF
oJN1uMAryoRzYd+YIsw58QJHRJuMnPjoLqjjGPVPS4cJasbZWuaKSyCWPgpyqRdH
Dpia0FnySZ/8Fi8RsDqEI/qMRrLQY+bYgQyT/tCAWVcpIJzTdreU1X6VX32+hMy4
NEqkATo1o52v764C0igR
=rCHO
-----END PGP SIGNATURE-----




Marked as found in versions nbd/2.9.16-8+squeeze1. Request was from Wouter Verhelst <wouter@debian.org> to control@bugs.debian.org. (Tue, 19 May 2015 20:51:10 GMT) (full text, mbox, link).


Marked as found in versions nbd/1:3.2-4~deb7u4. Request was from Wouter Verhelst <wouter@debian.org> to control@bugs.debian.org. (Tue, 19 May 2015 20:51:14 GMT) (full text, mbox, link).


No longer marked as found in versions nbd/2.9.16-8+squeeze1. Request was from Wouter Verhelst <wouter@debian.org> to control@bugs.debian.org. (Tue, 19 May 2015 20:51:19 GMT) (full text, mbox, link).


Marked as found in versions nbd/1:2.9.16-8+squeeze1. Request was from Wouter Verhelst <wouter@debian.org> to control@bugs.debian.org. (Tue, 19 May 2015 20:51:23 GMT) (full text, mbox, link).


Marked as found in versions nbd/1:3.2-4~deb7u4~bpo60+1. Request was from Wouter Verhelst <wouter@debian.org> to control@bugs.debian.org. (Tue, 19 May 2015 20:51:27 GMT) (full text, mbox, link).


Reply sent to Wouter Verhelst <wouter@debian.org>:
You have taken responsibility. (Sun, 24 May 2015 13:33:36 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Sun, 24 May 2015 13:33:36 GMT) (full text, mbox, link).


Message #40 received at 784657-close@bugs.debian.org (full text, mbox, reply):

From: Wouter Verhelst <wouter@debian.org>
To: 784657-close@bugs.debian.org
Subject: Bug#784657: fixed in nbd 1:3.8-4+deb8u1
Date: Sun, 24 May 2015 13:32:11 +0000
Source: nbd
Source-Version: 1:3.8-4+deb8u1

We believe that the bug you reported is fixed in the latest version of
nbd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 784657@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Wouter Verhelst <wouter@debian.org> (supplier of updated nbd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 17 May 2015 10:46:10 +0200
Source: nbd
Binary: nbd-server nbd-client nbd-client-udeb
Architecture: source amd64
Version: 1:3.8-4+deb8u1
Distribution: jessie-security
Urgency: medium
Maintainer: Wouter Verhelst <wouter@debian.org>
Changed-By: Wouter Verhelst <wouter@debian.org>
Description:
 nbd-client - Network Block Device protocol - client
 nbd-client-udeb - Network Block Device protocol - client for Debian Installer (udeb)
 nbd-server - Network Block Device protocol - server
Closes: 784657
Changes:
 nbd (1:3.8-4+deb8u1) jessie-security; urgency=medium
 .
   * Add fix for CVE-2015-0847. Closes: #784657.
Checksums-Sha1:
 0f46539e91f383a62419256ffded839c4e3913b2 1938 nbd_3.8-4+deb8u1.dsc
 7890715ced4695b1fa9ddb080e79f8497590d746 945343 nbd_3.8.orig.tar.gz
 97e0fec3ec310446372ca3c5f2362c5a9012d15e 93517 nbd_3.8-4+deb8u1.diff.gz
 7dd0ea2edd934b8ee6ea869094de583d5c6a1fb5 82042 nbd-server_3.8-4+deb8u1_amd64.deb
 899aaef99a5e734f88cb46ec94145d240e42361c 69068 nbd-client_3.8-4+deb8u1_amd64.deb
 0b9e2ae7f9729d5a64372691ddba35497caf92e6 9042 nbd-client-udeb_3.8-4+deb8u1_amd64.udeb
Checksums-Sha256:
 6de318c0346d3ade5465030442a572610b70e08109d8f1bedb0f11ad869a5fb1 1938 nbd_3.8-4+deb8u1.dsc
 bdcbfe6c5f01f5f46efb5cc5b7e10222d76d74d2056bbfb95e34522bd0fddcd9 945343 nbd_3.8.orig.tar.gz
 0f96f80ab8125bb05f17bfda4e033488e3cdf66781d4a50b007b3f44341719ce 93517 nbd_3.8-4+deb8u1.diff.gz
 00c1b4549d04c49f30c1071b27c61bbdf0af35d25b7ffd49159e7d0676653f43 82042 nbd-server_3.8-4+deb8u1_amd64.deb
 7102375e26690319c689fa16dde6b1f585d7f8a3331a763ed0229c1f53d77ec2 69068 nbd-client_3.8-4+deb8u1_amd64.deb
 1fe8c7177efa14a1a29b207ab3a2b929370e596a1effba027c9a37e63392c09e 9042 nbd-client-udeb_3.8-4+deb8u1_amd64.udeb
Files:
 98b45116dfa8b48bae0e0c3cd2c057be 1938 admin optional nbd_3.8-4+deb8u1.dsc
 35326f983d2671f7b41467a34a6f5844 945343 admin optional nbd_3.8.orig.tar.gz
 8668d30fa68647c80cb4f46ef8a435dd 93517 admin optional nbd_3.8-4+deb8u1.diff.gz
 8969f5dd79a3aa47b3aa0b700bb1a48a 82042 admin optional nbd-server_3.8-4+deb8u1_amd64.deb
 e59e0e6fdaedf7d6da0a85ea662db852 69068 admin optional nbd-client_3.8-4+deb8u1_amd64.deb
 886706822c43d04f91ed2bcc8671a98f 9042 debian-installer optional nbd-client-udeb_3.8-4+deb8u1_amd64.udeb
Package-Type: udeb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVXw9mAAoJEMKUD5Ub3wqdKeoQAJ3FyUFIWh6FCVHLAltNcrUt
AmRU+46e2vxUiBUAMT1EQvopiBkWeTTaoqv+LZw7ohqd+5Kt2NeMKiv+ZDj9F7n2
skeGaWSIBJDpZ9/h8ILEgYu4oEBQsE2F1eEJCIvCRCelL2cOBEyYOlC/Obzc7/ZY
SCesMX8+CR9hMS5s+OmVfR/sm3N7ExzU+xLM01T/vNKBHUqoiJn0gtGdZCMYBxx6
RfpvtuJnYgP+ZUkhcai+0YMt1Oz1jhVfk3vMaJGO14DVARjw+P9Yrk9taF4BHkDF
4d8LiFaKjiAe6y8Vx+CjQhImrLWE1KVdS08oH+yirCqG7k6vwMqWyvBJtQUvKMmf
OymFPPuGIO+FGMbRvC5+6l7l7FwQ3Af4hgEf0hxLEc5+Op6pKe36zQjx/uEojO/g
lHRpsyOKQj6+JurL8wS5Klw72Yrq/wtBbx66v/rONpPekS8a0KgMGBj1w0m+19SS
GRShQ1b7awWgaTW5OfS/5EWGDAYGSTnYk+A3ao/RgY6Lo+ren7k2pcZwZrLL0U4O
ikLl4+m8GpAHjKd8ANDg8ZLwArzn12i3aEUlR4acdl9OY72jIs8GrGorWVNmsYiW
MmJyhtBZIfxk/OnIzWe1ifmHOF2zpm2XVkmmNYPTyW8KOfdjrFbzBArA65bYJDJ/
bXHMnX116A/P1teRm2jf
=APHH
-----END PGP SIGNATURE-----




Reply sent to Wouter Verhelst <wouter@debian.org>:
You have taken responsibility. (Sun, 24 May 2015 13:34:04 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Sun, 24 May 2015 13:34:04 GMT) (full text, mbox, link).


Message #45 received at 784657-close@bugs.debian.org (full text, mbox, reply):

From: Wouter Verhelst <wouter@debian.org>
To: 784657-close@bugs.debian.org
Subject: Bug#784657: fixed in nbd 1:3.2-4~deb7u5
Date: Sun, 24 May 2015 13:32:40 +0000
Source: nbd
Source-Version: 1:3.2-4~deb7u5

We believe that the bug you reported is fixed in the latest version of
nbd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 784657@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Wouter Verhelst <wouter@debian.org> (supplier of updated nbd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 15 May 2015 13:03:42 +0200
Source: nbd
Binary: nbd-server nbd-client nbd-client-udeb
Architecture: source amd64
Version: 1:3.2-4~deb7u5
Distribution: oldstable-security
Urgency: medium
Maintainer: Wouter Verhelst <wouter@debian.org>
Changed-By: Wouter Verhelst <wouter@debian.org>
Description: 
 nbd-client - Network Block Device protocol - client
 nbd-client-udeb - Network Block Device protocol - client for Debian Installer (udeb)
 nbd-server - Network Block Device protocol - server
Closes: 781547 784657
Changes: 
 nbd (1:3.2-4~deb7u5) oldstable-security; urgency=medium
 .
   * Backport fix for CVE-2015-0847 to fix handling of SIGTERM and SIGCHLD.
     Closes: #784657.
   * Merge patch by Tuomas Räsänen to do all negotiation in the child
     process. Closes: #781547, CVE-2013-7441.
Checksums-Sha1: 
 0897e07a2b04cfaf70a2da4fe758f61d26c18e7c 1906 nbd_3.2-4~deb7u5.dsc
 5cdd331603b4b296b32cc2607cfc0e4945bb627e 115363 nbd_3.2-4~deb7u5.diff.gz
 5b5b09227bb8fca08fc09f8469d971025af36cd9 75060 nbd-server_3.2-4~deb7u5_amd64.deb
 a65d8f00a8f4e2b42fed73106c93561dbe92a984 63900 nbd-client_3.2-4~deb7u5_amd64.deb
 1cfcd2b27d549b6da75ca033899fc882ba37d4cf 8104 nbd-client-udeb_3.2-4~deb7u5_amd64.udeb
Checksums-Sha256: 
 6acde77baa273acb9c940968fcda3146344ba639449770217c6aea3e061afe9f 1906 nbd_3.2-4~deb7u5.dsc
 ea441327a7cc6d8b96a144e88d3e7c784cef76614b301f86d2d7689b440bf159 115363 nbd_3.2-4~deb7u5.diff.gz
 8930a7956977ddf8cfbf100810c057b76244afa987db8afdda9465c32f0183d6 75060 nbd-server_3.2-4~deb7u5_amd64.deb
 e130df34097cb3ef9669291e1426658dc68195786bb8877a59aef23472455779 63900 nbd-client_3.2-4~deb7u5_amd64.deb
 a0a91fd8da84ccaa83b10ec5817c5de80fdd5da4ffe7ed8bcbb8aab371367b4f 8104 nbd-client-udeb_3.2-4~deb7u5_amd64.udeb
Files: 
 4f44babb856a5cf29837d4945e3b7e11 1906 admin optional nbd_3.2-4~deb7u5.dsc
 e3adbaec367f828873e92f8fde5ad087 115363 admin optional nbd_3.2-4~deb7u5.diff.gz
 d836a28cd8b3736473121e6aa226d2f4 75060 admin optional nbd-server_3.2-4~deb7u5_amd64.deb
 25f74db4c921bef8e80ea0f9f2d615d6 63900 admin optional nbd-client_3.2-4~deb7u5_amd64.deb
 dd4fd331b8202a7b1cf2a07d054e9000 8104 debian-installer optional nbd-client-udeb_3.2-4~deb7u5_amd64.udeb
Package-Type: udeb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVXuY2AAoJEMKUD5Ub3wqd7H4P+wVU+0ZGhEjfxJnMZ+ZM5Lyr
z3I/PnxF6+j0OB4PQwEzh81opmpqh5s9nbb119QQ/V9hnCUec4+dkID8Q4uSzB+5
NTQ967E2yk03BlXEqoTLJc3uWntDl6vxvxwyNi9+qLYPidS6Yn1Gd86fvgICd0vR
nVBnCAqSl8ixNvMaFNleqCmMk/lJHM3uwF6lkWSvRnANOkpqOUShdlNbDMp4qEI5
BKdNTgYY4BfPQz1sSNUDeTnguOz8KobhsDdaSVGtza7bgmE0mVbUZag9+VGGuk21
VgcsZXqkWGflaGn4CSWSTMwmpTE5qnykUOmVKilRvatNDBYDRdurrJstBN9chTUu
36f5yYcluUlUkaIgIBBxZECF3me99FidUhiz5R4yCr4ary1L9R+pq6RTKDSe+Bm4
AgVQWV9XoJBpThmP2cYhfIg8aVufqawTD4xFutYR3hX91OVhwE4GRcQqc+SzIVue
4pQQx63yxoP5DJBoX/eXAeYDxu7nMK3l/1ymsTIS6bBzU2fjPIuPJ8ia3IiDvY+t
BXgq4s4ief9pjJPmKeHTGtPBcdcerqjCW5VtdftrJ8w7gM4gVUuKQitpNnqTg5LO
9GAlFFM8RQF09goUS4Wmw2LQtxkwq7i3y9mSIny9h7UFI4X7yh4jjR9eaVmR0VKL
9SIWdsPLz7hZ56bKTTSq
=tsd6
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 22 Jun 2015 07:29:28 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 14:19:07 2019; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.